3 ms·
> We encourage everyone to configure their relays to do updates automatically I understand the general security benefits of automatic updates, but on something
by forapurpose 8y ago
> We encourage everyone to configure their relays to do updates automatically
I understand the general security benefits of automatic updates, but on something with as big a target on its back as Tor, isn't it asking for trouble? An attacker could poison an update and make vulnerable the entire network for as long as it takes for the Tor Project to discover the problem and patch it.
How does the security professional balance such issues? I can imagine mitigating the risk with rolling updates, but the 0-days aren't patched immediately.
- fyfy18 8y agoHow about if the node just shutdown after X period of no updates? It would be inconvenient for the admin and users specifically using that node, but would be a win for overall network security. It could still expose a vulnerability meaning someone could kill the whole network, but that’s better than compromising it.
- cyphar 8y agoTor routes more packets through "trusted" nodes that have a history of being fast, and so on. I wonder whether an automated kill switch would affect those statistics (resulting in possibly lower overall network bandwidth because the trust level of most nodes would be worse).
- Xophmeister 8y agoIf trust is quantified by node, then surely it could just be reduced as a function of outdatedness.
- LinuxBender 8y agoThis is a great idea. I would make it configurable, with a vaguely worded configuration directive like: DisableAutoDisable I_Know_What_I_Am_Doing Then add logic that prefers up to date nodes over out of date nodes, if that does not already exist.